The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

ABSTRACT

We present new techniques that allow a return-into-libc attack to be mounted on x86 executables that calls no functions at all. Our attack combines a large number of short instruction sequences to build gadgets that allow arbitrary computation. We show how to discover such instruction sequences by means of static analysis. We make use, in an essential way, of the properties of the x86 instruction set.

REFERENCES

• 1: Aleph One. Smashing the stack for fun and profit. Phrack Magazine, 49(14), Nov. 1996. http://www.phrack.org/archives/49/P49-14.
• 2: Anonymous. Once upon a free(). Phrack Magazine, 57(9), Aug. 2001. http://www.phrack.org/archives/57/p57-0x09.
• 3: Elena Gabriela Barrantes , David H. Ackley , Stephanie Forrest , Darko Stefanović, Randomized instruction set emulation, ACM Transactions on Information and System Security (TISSEC), v.8 n.1, p.3-40, February 2005 [doi>10.1145/1053283.1053286]
• 4: blexim. Basic integer overflows. Phrack Magazine, 60(10), Dec. 2002. http://www.phrack.org/archives/60/p60-0x0a.txt.
• 5: J. R. Crandall, S. F. Wu, and F. T. Chong. Experiences using Minos as a tool for capturing and analyzing novel worms for unknown vulnerabilities. In K. Julisch and C. Krügel, editors, Detection of Intrusions and Malware, and Vulnerability Assessment, Second International Conference, DIMVA 2005, volume 3548 of LNCS, pages 32--50. Springer-Verlag, July 2005.
• 6: dark spyrit. Win32 buffer overflows (location, exploitation and prevention). Phrack Magazine, 55(15), Sept. 1999. http://www.phrack.org/archives/55/P55-15.
• 7: M. Garg. About ELF auxiliary vectors, Aug. 2006. Online: manugarg.googlepages.com/aboutelfauxiliaryvectors.
• 8: M. Garg. Sysenter based system call mechanism in Linux 2.6, July 2006. Online: manugarg.googlepages.com/systemcallinlinux2_6.html.
• 9: Gera. Insecure programming by example, 2002. Online: community.corest.com/~gera/InsecureProgramming/.
• 10: gera and riq. Advances in format string exploiting. Phrack Magazine, 59(7), July 2001. http://www.phrack.org/archives/59/p59-0x07.txt.
• 11: O. Horovitz. Big loop integer protection. Phrack Magazine, 60(9), Dec. 2002. http://www.phrack.org/archives/60/p60-0x09.txt.
• 12: Intel Corporation. IA-32 Intel Architecture Software Developer's Manual, Volume 2: Instruction Set Reference, 2001.
• 13: M. Kaempf. Vudo malloc tricks. Phrack Magazine, 57(8), Aug. 2001. http://www.phrack.org/archives/57/p57-0x08.
• 14: klog. The frame pointer overwrite. Phrack Magazine, 55(8), Sept. 1999. http://www.phrack.org/archives/55/P55-08.
• 15: S. Krahmer. x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique, Sept. 2005. Online: http://www.suse.de/~krahmer/no-nx.pdf.
• 16: Christopher Kruegel , Engin Kirda , Darren Mutz , William Robertson , Giovanni Vigna, Automating mimicry attacks using static binary analysis, Proceedings of the 14th conference on USENIX Security Symposium, p.11-11, July 31-August 05, 2005, Baltimore, MD
• 17: D. Litchfield. Defeating the stack based buffer overflow prevention mechanism of Microsoft Windows 2003 Server, Sept. 2003. Online: http://www.ngssoftware.com/papers/defeating-w2k3-stack-protection.pdf.
• 18: mammon_. The Bastard project: libdisasm. http://bastard.sourceforge.net/libdisasm.html.
• 19: Stephen McCamant , Greg Morrisett, Evaluating SFI for a CISC architecture, Proceedings of the 15th conference on USENIX Security Symposium, p.15-15, July 31-August 04, 2006, Vancouver, B.C., Canada
• 20: J. McDonald. Defeating Solaris/SPARC non-executable stack protection. Bugtraq, Mar. 1999.
• 21: Nergal. The advanced return-into-lib(c) exploits (PaX case study). Phrack Magazine, 58(4), Dec. 2001. http://www.phrack.org/archives/58/p58-0x04.
• 22: PaX Team. PaX non-executable pages design & implementation. pax.grsecurity.net/docs/noexec.txt.
• 23: M. Riepe. GNU Libelf. http://www.mr511.de/software/.
• 24: rix. Writing ia32 alphanumeric shellcodes). Phrack Magazine, 57(15), Dec. 2001. http://www.phrack.org/archives/57/p57-0x18.
• 25: Scut/team teso. Exploiting format string vulnerabilities. http://www.team-teso.net, 2001.
• 26: H. Shacham. The geometry of innocent flesh on the bone, Oct. 2007. Online: http://hovav.net/dist/geometry.pdf.
• 27: Hovav Shacham , Matthew Page , Ben Pfaff , Eu-Jin Goh , Nagendra Modadugu , Dan Boneh, On the effectiveness of address-space randomization, Proceedings of the 11th ACM conference on Computer and communications security, October 25-29, 2004, Washington DC, USA [doi>10.1145/1030083.1030124]
• 28: Solar Designer. "return-to-libc" attack. Bugtraq, Aug. 1997.
• 29: Solar Designer. JPEG COM marker processing vulnerability in Netscape browsers, July 2000. Online: www.openwall.com/advisories/OW-002-netscape-jpeg/.
• 30: Ana Nora Sovarel , David Evans , Nathanael Paul, Where's the FEEB? the effectiveness of instruction set randomization, Proceedings of the 14th conference on USENIX Security Symposium, p.10-10, July 31-August 05, 2005, Baltimore, MD
• 31: The Metasploit Project. Shellcode archive. Online: http://www.metasploit.com/shellcode.html.
• 32: The Santa Cruz Operation. System V Application Binary Interface: Intel386 Architecture Processor Supplement, fourth edition, 1996.
• 33: D. Wheeler. Secure Programming for Linux and Unix HOWTO. Linux Documentation Project, 2003. Online: http://www.dwheeler.com/secure-programs/.
• 34: M. Zalewski. Remote vulnerability in SSH daemon CRC32 compression attack detector, Feb. 2001. Online: http://www.bindview.com/Support/RAZOR/Advisories/2001/adv_ssh1crc.cfm.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

General Terms:
Algorithms, Security

Keywords:
instruction set, return-into-libc, turing completeness